search

CasualX / pelite

Lightweight, memory-safe, zero-allocation library for reading and navigating PE binaries.
MIT License
280 stars 42 forks source link

Writing to imports #251

Closed iraizo closed 1 year ago

iraizo commented 2 years ago

My current goal is to fix the imports, replacing the pointer to the imported function in the module i want to map from the process iat. The problem is pelite only has a way to get the imports and not write them since i want to later on write them into the pefile, convert them back to an byte array and then overwrite the pe header.

Is there a manual way to do this?

iraizo commented 2 years ago

i guess calling .image() would solve having the byte array, but not how to actually write the imports

CasualX commented 2 years ago

Unfortunately this use case isn't really supported due to pelite using shared borrows everywhere.

The best alternative is to gather a set of 'todo' modifications and after destroying all pelite related objects to 'apply' these modifications when there's no more pelite shared borrows active.

iraizo commented 2 years ago

Could you give me an example for this? I dont really understand it due to not using rust for a long time yet.

What I've seen is that most of the structs like Imports arent a field in the PE struct but rather just passing a PeFile inside the Imports struct, but no way to overwrite the imports in the actual FileMap, and .image() would also not work due to Imports and PeFile not being "connected"